14b5e85b18
In the DIOCRSETADDRS ioctl() handler we allocate a table for struct pfr_addrs,
which is processed in pfr_set_addrs(). At the users request we also provide
feedback on the deleted addresses, by storing them after the new list
('bcopy(&ad, addr + size + i, sizeof(ad));' in pfr_set_addrs()).
This means we write outside the bounds of the buffer we've just allocated.
We need to look at pfrio_size2 instead (i.e. the size the user reserved for our
feedback). That'd allow a malicious user to specify a smaller pfrio_size2 than
pfrio_size though, in which case we'd still read outside of the allocated
buffer. Instead we allocate the largest of the two values.
Reported By: Paul J Murphy <paul@inetstat.net>
PR: 207463
MFC after: 5 days
Differential Revision: https://reviews.freebsd.org/D5426
|
||
|---|---|---|
| .. | ||
| if_pflog.c | ||
| if_pfsync.c | ||
| in4_cksum.c | ||
| pf_altq.h | ||
| pf_if.c | ||
| pf_ioctl.c | ||
| pf_lb.c | ||
| pf_mtag.h | ||
| pf_norm.c | ||
| pf_osfp.c | ||
| pf_ruleset.c | ||
| pf_table.c | ||
| pf.c | ||
| pf.h | ||